CVE-2025-69231: OpenEMR Stored XSS Vulnerability

CVE-2025-69231 Overview

CVE-2025-69231 is a stored cross-site scripting (XSS) vulnerability in OpenEMR, a widely-used open source electronic health records (EHR) and medical practice management application. The vulnerability exists in the GAD-7 anxiety assessment form and allows authenticated users with clinician privileges to inject malicious JavaScript code that executes when other users view the form.

This stored XSS vulnerability is particularly dangerous in healthcare environments as it can enable session hijacking, account takeover, and privilege escalation from clinician to administrator roles. Given OpenEMR's deployment in medical facilities handling sensitive patient data, successful exploitation could lead to unauthorized access to protected health information (PHI).

Critical Impact

Authenticated attackers with clinician privileges can inject persistent JavaScript payloads to hijack sessions and escalate privileges to administrator level, potentially compromising patient data and entire healthcare systems.

Affected Products

• OpenEMR versions prior to 8.0.0

Discovery Timeline

• 2026-02-25 - CVE-2025-69231 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-69231

Vulnerability Analysis

This stored XSS vulnerability resides in the GAD-7 (Generalized Anxiety Disorder 7-item scale) form component of OpenEMR. The root cause is insufficient input sanitization when rendering user-controlled data within JavaScript contexts in the form view template.

The vulnerable code in interface/forms/gad7/view.php directly outputs user-supplied values using the text() function, which provides HTML entity encoding but does not properly escape data for JavaScript contexts. When a clinician enters malicious JavaScript in form fields, the payload is stored in the database and executed whenever another user views the assessment form.

The attack vector is network-based and requires low privilege (clinician account) along with user interaction (victim must view the form). The scope is changed, meaning the vulnerability can affect resources beyond its original security context—enabling escalation from clinician to administrator privileges.

Root Cause

The vulnerability stems from improper output encoding in interface/forms/gad7/view.php. The code uses PHP's text() function for data that is being placed into a JavaScript context. While text() provides HTML entity encoding, it does not properly escape data for safe inclusion in JavaScript code blocks. The proper function for JavaScript contexts is js_escape(), which performs the necessary escaping to prevent script injection.

Attack Vector

An attacker with clinician-level access can craft a malicious payload containing JavaScript code and submit it through the GAD-7 assessment form. When the form data is stored and subsequently rendered for other users (including administrators), the injected JavaScript executes in the victim's browser context. This enables:

1. Session Hijacking - Stealing session cookies to impersonate the victim
2. Account Takeover - Capturing credentials or performing actions as the victim
3. Privilege Escalation - If an administrator views the form, the attacker gains admin-level access

// Vulnerable code - uses text() which is insufficient for JavaScript context
document.my_form.nervous_score.options[<?php echo text($obj['nervous_score']); ?>].defaultSelected=true;
var i = <?php echo text($obj['nervous_score']); ?> ; //the value from last time

// Fixed code - uses js_escape() for proper JavaScript context encoding
document.my_form.nervous_score.options[<?php echo js_escape($obj['nervous_score']); ?>].defaultSelected=true;
var i = <?php echo js_escape($obj['nervous_score']); ?> ; //the value from last time

Source: GitHub Commit Details

Detection Methods for CVE-2025-69231

Indicators of Compromise

• Unusual JavaScript patterns in GAD-7 form data fields, particularly in score-related fields
• Database entries in GAD-7 assessment tables containing script tags or JavaScript event handlers
• Unexpected network requests originating from the OpenEMR application to external domains
• Session anomalies where administrator actions originate from clinician user contexts

Detection Strategies

• Monitor web application logs for suspicious form submissions containing JavaScript keywords (<script>, onerror, onclick, javascript:)
• Implement Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Deploy web application firewall (WAF) rules to detect XSS patterns in POST data to GAD-7 form endpoints
• Review database audit logs for form entries containing encoded or obfuscated script content

Monitoring Recommendations

• Enable detailed logging for all form submissions in OpenEMR, particularly clinical assessment forms
• Configure alerting for any JavaScript-related strings appearing in form field values
• Monitor for unusual session activity patterns, especially privilege changes following form views
• Implement browser-side CSP violation reporting to detect attempted script injections

How to Mitigate CVE-2025-69231

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0 or later immediately
• Review existing GAD-7 form submissions for potentially malicious content
• Audit administrator accounts for signs of unauthorized access or session hijacking
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

OpenEMR has addressed this vulnerability in version 8.0.0. The fix replaces the text() function with js_escape() for all user-controlled data rendered within JavaScript contexts in the GAD-7 form view. Organizations should update to version 8.0.0 or apply the security patch referenced in commit 5f20b756441fc9868f43410a9ef97536c38b2ba6.

For detailed patch information, see the GitHub Security Advisory and commit details.

Workarounds

• Restrict clinician access to GAD-7 form functionality until patching is complete
• Implement WAF rules to sanitize or block JavaScript patterns in form submissions
• Enable strict Content Security Policy headers to prevent inline script execution
• Consider temporarily disabling the GAD-7 assessment feature if not critical to operations

# Example Apache configuration to add CSP headers for OpenEMR
<Directory "/var/www/html/openemr">
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
</Directory>